Andy DixonandClaude Opus 5.5
3264def658
fix: sanitise snapshot follow mode; least-privilege CI token The scan-info view printed the snapshot's "follow" metadata string unsanitised (the canvas filter was the only defence). The CI workflow ran with the repository's default GITHUB_TOKEN permissions; it only needs to read the code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
843 B
YAML
33 lines
843 B
YAML
name: ci
|
|
on:
|
|
push:
|
|
pull_request:
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
test:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
- name: format
|
|
if: runner.os == 'Linux'
|
|
run: test -z "$(gofmt -l .)"
|
|
- run: go vet ./...
|
|
- run: go test ./...
|
|
- name: race
|
|
if: runner.os != 'Windows'
|
|
run: go test -race ./...
|
|
- name: cross-build
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
for t in linux/arm64 linux/386 darwin/arm64 windows/amd64 freebsd/amd64; do
|
|
GOOS=${t%/*} GOARCH=${t#*/} CGO_ENABLED=0 go build -o /dev/null ./cmd/mapsize
|
|
done
|